CVE-2020-28391 Explained : Impact and Mitigation

A vulnerability has been identified in SCALANCE X-200 switch family, SCALANCE X-200IRT switch family, and SCALANCE X-200RNA switch family.

Understanding CVE-2020-28391

This CVE involves a cryptographic key vulnerability that could lead to a man-in-the-middle attack.

What is CVE-2020-28391?

The vulnerability allows attackers to decrypt previously captured traffic due to the devices using a hardcoded private RSA key when used with C-PLUG.

The Impact of CVE-2020-28391

Exploiting this vulnerability could result in unauthorized access to sensitive information and compromise the integrity of communication.

Technical Details of CVE-2020-28391

The following technical details outline the specifics of this CVE.

Vulnerability Description

Devices in the SCALANCE X-200 switch family, SCALANCE X-200IRT switch family, and SCALANCE X-200RNA switch family create a new unique key upon factory reset, except when used with C-PLUG, where a hardcoded private RSA key is utilized.

Affected Systems and Versions

Siemens SCALANCE X-200 switch family (incl. SIPLUS NET variants) - All versions < V5.2.5
Siemens SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) - All versions < V5.5.0
Siemens SCALANCE X-200RNA switch family - All versions < V3.2.7

Exploitation Mechanism

Attackers can exploit this vulnerability to conduct man-in-the-middle attacks and decrypt previously captured traffic.

Mitigation and Prevention

Protecting systems from CVE-2020-28391 requires immediate actions and long-term security practices.

Immediate Steps to Take

Update affected devices to versions V5.2.5, V5.5.0, and V3.2.7 or higher to mitigate the vulnerability.
Implement network segmentation to limit the impact of potential attacks.

Long-Term Security Practices

Regularly monitor network traffic for any suspicious activities.
Conduct security assessments and penetration testing to identify and address vulnerabilities.

Patching and Updates

Apply patches and firmware updates provided by Siemens to address the cryptographic key vulnerability.